redb.Identity

redb 4.0 Released: XML Routes, Lazy References, Unique Keys and WS-Trust Across the Ecosystem

The redb ecosystem has delivered a major simultaneous release across all core components, bringing redb.Core, redb.Route, redb.Tsak and redb.Identity to version 4.0.0. The update introduces declarative XML routing, lazy object references, unique key constraints, and a full WS-Trust SOAP facade while closing multiple security issues reported through external audits and community feedback. Seventy-six NuGet packages, seven container images and platform archives for Windows and Linux are now available, with the Pro edition remaining free and license-free throughout the 4.x line. Significant internal changes include a unified expression language, support for modern data formats such as Protobuf and Avro, and improved handling of distributed caches and OpenTelemetry metrics. Security hardening covers header sanitization in all identity facades, consent-page protections, dashboard access controls and a switch to bcrypt password hashing. Existing clusters must be stopped before upgrade because mixed versions are not supported, and large databases require a maintenance window for schema changes and partial index creation.

redb.Identity Deploys Three-Layer Defense to Neutralize Stolen Access Tokens in OpenID Connect

redb.Identity, a custom OAuth 2.1 and OpenID Connect provider built on .NET, addresses the inherent risks of bearer access tokens by implementing three distinct protection layers. The first layer uses a Backend-for-Frontend pattern with Blazor Server and HttpOnly cookies to ensure no tokens ever reach the browser. The second layer applies DPoP proof-of-possession binding so that a stolen token remains useless without the corresponding private key. The third layer provides rapid revocation through RFC 7009 endpoints, refresh token rotation, idle timeouts, and a hybrid push-pull backchannel logout mechanism that guarantees no revocation is lost across replicas. The architecture also mitigates XSS vectors from direct application code, compromised npm dependencies, browser extensions, and localStorage. Additional routine controls include constant-time secret comparison, TOTP replay protection, rate limiting at multiple scopes, and sanitized proxy headers. The design explicitly acknowledges that BFF shifts rather than eliminates risk, requiring complementary CSRF protection via SameSite cookies and antiforgery tokens.

redb.Identity Adds gRPC Transport for OpenID Server Alongside Existing HTTP Facade

redb.Identity has introduced a second transport layer using gRPC next to its existing HTTP interface, sharing the same core routes, client registry, token store, and authorization logic. The new facade exposes standard OAuth and OpenID Connect operations such as Token, Introspect, Revoke, UserInfo, Discovery, and Jwks through protobuf-defined methods under identity.v1.Identity. Both transports enforce identical verdicts based on a single centralized scope table located behind direct-vm addresses, ensuring that a client authorized via HTTP receives the same result when calling gRPC. Error handling on gRPC uses status codes and trailers to carry machine-readable OAuth error codes and retry-after values, preserving compatibility with existing interceptors and tracing. Browser-facing flows, DPoP proofs, and user self-service remain on HTTP, while administrative operations are available on a separate management port. The implementation was validated through 64 unit tests, cross-language interop with @grpc/grpc-js clients, and a conformance run against the official OpenID Foundation suite.